The Agency Share of UK Cyber Adverts Fell From 42% to 26%. Nobody Is Measuring What Replaced It.

Two things happened to UK cyber security hiring between 2023 and 2025. Advertised demand fell by roughly 28%, and the share of postings advertised through a recruitment agency fell from 42% to 26%. More candidates are competing for fewer roles, through a channel employers themselves control, at the point where both sides have started using machines to write and to read. Whether that is working is a question no UK dataset can answer, and one most boards are not asking.

The data

Cyber security skills in the UK labour market 2026, commissioned by the Department for Science, Innovation and Technology from Ipsos and Perspective Economics, was published on 29 September 2026. Its demand chapter analyses 34,932 core cyber job postings placed between January and December 2025, drawn from Lightcast online postings data.

Start with the size of the market. Core cyber postings fell 33% from 48,492 in 2023 to 32,671 in 2024, then recovered 7% to 34,932 in 2025, a fall of roughly 28% across the two years. DSIT cautions that the recovery "may represent market stabilisation rather than a return to the levels of high demand".

A line in the same chapter has drawn very little comment. "The proportion of job postings that were advertised through a recruitment agency appears to have continued to decline, from 42% in 2023, 33% in 2024, to 26% in 2025." Advertised demand fell by about 28%. The agency-advertised share fell by 16 percentage points, a relative decline of some 38%. The agency channel contracted faster than the market it serves.

DSIT records the consequence in employers' own words. "In general though, falling demand for cyber security professionals had led to increasing competition for jobs." Some employers reported being inundated with applications. A micro business in the cyber sector said: "We don't even advertise anymore because we put an advert on LinkedIn, I think we had 1,300 CVs in the first week."

Those employers also questioned what they were reading. A small cyber sector business described "CVs that look like they've been written by AI", which the report presents as perception, not measurement. In a separate passage on why candidates fail, employers said that some had overclaimed the skills they had. A large employer outside the cyber sector was blunter: "Lots of people turn up for interview and claim they can do the stuff and then they fail the technicals." DSIT treats the consequence as a possibility rather than a finding, suggesting that higher application volumes could lead employers to rely "more on informal networks and referrals for recruitment".

One further figure matters. Some 76% of core cyber postings in 2025 carried no salary information, up from 70% in 2023 and 75% in 2024.

Employers have been adopting their own automation over the same period, though no survey establishes that one caused the other. The 2026 Barclay Simpson cyber security salary guide reports that 63% of the employers it surveyed use AI for CV screening and shortlisting, while 44% saw AI as a threat. Some 74% named the integrity of CV information as a concern, and half said they worried about establishing the identity of candidates. Only 14% believed AI had made recruitment both more effective and more efficient.

Advertised demand fell by roughly 28% between 2023 and 2025. The agency-advertised share fell by 38% in relative terms over the same period. Sources: DSIT, Cyber security skills in the UK labour market 2026; Barclay Simpson, 2026 Cyber Security Salary Guide.

Why this one matters

The usual reading of a shrinking agency share is that employers have got better at hiring directly and have stripped out a cost. On these numbers that reading is premature.

A caution belongs here first, because the figure has been quoted loosely. A fall in agency-advertised postings does not prove that agencies are doing less work. The measure counts online adverts, and a role worked quietly from a network never becomes an advert at all. DSIT hedges the trend itself, saying it "appears to have continued to decline". What the series supports is narrower: the visible, advertised, agency-led route into UK cyber security roles is shrinking, and the routes taking its place are ones no published dataset measures.

That is the problem worth putting in front of a board. When sourcing ran through an agency, the cost was a fee, visible and arguable, and so was the filtering it bought. When it runs through an inbox or a referral, the fee disappears and the filtering becomes somebody's unmeasured Tuesday. The work did not stop; it moved somewhere nobody reports on.

The automation findings sharpen the position. Candidates are competing harder for fewer roles, three quarters of which advertise no price, so they apply in order to find out. Employers told DSIT they suspect some applications are machine-written, and most of the employers Barclay Simpson surveyed screen with a machine of their own. No one of these observations proves anything about hire quality. Together they describe a filtering mechanism under strain inside organisations that have absorbed it without appointing anyone to own it.

None of this means the skills shortage has gone away. DSIT reports 57% of UK businesses with a basic technical skills gap, up from 49% a year earlier. A second problem now sits on top of a real one, at the intake stage, and unlike the shortage it has neither measurement nor owner.

The commercial exposure

Regulatory. The Cyber Security and Resilience Bill completed its third reading in the House of Lords on 2 November 2026, after two government defeats at report stage on 26 October, and has returned to the Commons for consideration of Lords amendments. Royal Assent has not been given, and most of the substance is expected through secondary legislation and through Security and Resilience Requirements still to be consulted on. ISACA, writing on 5 November 2026, records the Minister confirming at report stage that those Requirements would include proposals for skilled and accredited individuals to hold senior accountability for cyber resilience. That is one organisation's account of a ministerial statement about future proposals, and it should be weighed as such.

The direction is consistent with obligations already binding firms with EU operations. NIS2 Article 20(2) requires Member States to ensure that members of the management bodies of essential and important entities follow training. DORA Article 5(4) requires members of a financial entity's management body to keep their knowledge and skills current enough to understand and assess ICT risk, including by following specific training on a regular basis. Neither addresses vacancies, and neither reaches a purely domestic UK organisation. The pattern is what matters: duties attaching to identified people with current competence. The voluntary Cyber Governance Code of Practice, published by DSIT with the NCSC in April 2025, points the same way by making People one of its five principles for boards, though it carries no legal duty.

Contractual. Enterprise security schedules commonly name an accountable individual, a response time and a review cadence. Where they do, a supplier that cannot staff the role holds an obligation it cannot presently meet, and the gap surfaces at a customer assurance review well before it reaches an audit.

Transactional. Diligence on security capability has broadened from tooling to ownership. An unfilled lead role, or one filled three times in two years, is the kind of finding a buyer's team raises in the data room, and findings raised there affect price.

Insurance. Cyber policies are written against representations about the controls an organisation operates. Where a control has no owner for a quarter, the accuracy of those representations becomes a live question, and an insurer is likelier to ask it after a loss than before one.

The Intake Ledger

Headcount reporting shows a vacancy or no vacancy, which says nothing about whether the mechanism that fills it works. Four entries make that mechanism visible, and every one can be produced from records a company already holds.

Channel. How does each open role reach the market, and who owns the shortlist? Where the answer is a job board and the hiring manager's inbox, the firm has absorbed a specialist function without appointing anybody to it.

Volume. How many applications did the last three security roles attract, and how many could a person actually evaluate? The second figure is the one that matters, and it is very rarely recorded.

Validation. What does the process test, what does it simply accept, and at which stage is a candidate's identity established? Half the employers in the Barclay Simpson survey raised identity as a concern, which makes a conversation and a CV a thin answer.

Interval. How long has each security seat been open, who holds the control while it is empty, and what is the delay worth? ISC2's hiring trends study, fieldwork in December 2024 across 929 hiring managers in six countries, found 56% put the time for an entry-level hire to reach independent task handling at four to nine months. Only 155 of those managers were in the UK, so read it as direction, not as a UK benchmark. The interval does not close on the start date.

The Intake Ledger: four questions a board can put to a security hiring process, covering Channel, Volume, Validation and Interval.

What leaders should do now

1. Put intake on the risk register, not the HR report. Where a control has a named owner in your framework, the period for which that owner's seat is vacant is a measurable control gap and should be reported as one.

1. Record the assessable application rate for every security role. Applications received, set against applications a person could evaluate. Two or three roles will show whether your funnel is working or merely full.

1. Decide where competence and identity are established, and write it down. A technical exercise, a structured reference and a paid work sample are all defensible choices. Choose the instrument before the next advert goes out.

1. Price the interval alongside the fee. Agency cost is easy to compare and easy to cut. Set it against the loaded cost of ninety days of an unowned control, the hiring manager's displaced time, and the probability of a mis-hire. That comparison can reverse the decision, and it is rarely run.

1. Publish the band. Three quarters of core cyber adverts give no salary. An advert with no price invites the whole market, and on current demand the whole market is available.

Three questions for the board

1. Which of our named security control owners are currently vacant, and for how long has each seat been open?

1. For our last three security hires, how many applications arrived, how many could a person assess, and who did the assessing?

1. If a major customer or a regulator asked us this quarter to evidence that an accountable, suitably skilled individual operates each security control, what would we be unable to show?

The strategic takeaway

The UK market has changed how security roles are bought. Advertised demand has fallen by roughly 28%, the agency-advertised share has fallen further, and the routes taking up the difference sit outside every published measure. None of that appears as a cost, which is why it warrants a board's attention.

Intake has become a control. It is not yet a failed one, and this briefing does not claim that it is, because the UK evidence for such a claim does not exist. It has become an unmeasured control, sitting upstream of every regulatory, contractual and insurance obligation that depends on a named, competent human being.

Confidence note

Confirmed. The DSIT postings, agency share, salary disclosure and skills gap figures quoted above, and the employer quotations, as published in Cyber security skills in the UK labour market 2026 on 29 September 2026. The Barclay Simpson 2026 percentages as published in that guide. The ISC2 figures and sample as published in its hiring trends study of June 2025. The Cyber Security and Resilience Bill completed Lords third reading on 2 November 2026, following two government defeats at report stage on 26 October 2026, and has not received Royal Assent.

Assessed. That the fall in agency-advertised postings reflects a genuine shift toward direct and network sourcing. DSIT hedges the trend, the measure counts online adverts only, and agency activity that never becomes an advert is invisible to it. That the intake mechanism is under strain is an inference drawn from the employer accounts in the DSIT report and the Barclay Simpson sentiment data, neither of which measures outcomes. The four commercial exposures above describe how regulatory, contractual, transactional and insurance practice can be expected to treat an unowned control. They are reasoned positions on current practice, not findings from a dataset, and none is legal advice.

Not known. Median time to fill a UK cyber security vacancy. The proportion of applications that are assessable by a person. Whether in-house sifting produces better or worse hires than agency sifting. How much agency activity now takes place without an advert. The Barclay Simpson guide publishes no sample size and no fieldwork dates, so its percentages should be read as the sentiment of the employers it surveyed, not as population estimates. No UK dataset currently answers any of these questions, and that absence is itself the argument of this briefing.

Where Garzon Cyber Solutions fits

We should declare the obvious interest. We run a recruitment practice, so we are not a disinterested party on the value of external sourcing. The measurement gap above would be worth putting to a board whether or not we existed.

We are a young firm. We publish our own research, and our recruitment work is run personally by our founder. Security and technology hiring would be delivered on a contingency basis, with nothing payable unless and until a candidate accepts and starts, and no CV would be sent to a hiring company without the candidate's explicit permission for that specific role.

If the three questions above are ones you cannot answer this morning, that is the conversation we would want to have, and it starts with capability rather than with a vacancy.

For the full research series, visit the Garzon Cyber Solutions Website.

Garzon Cyber Solutions delivers cybersecurity advisory, compliance certification and specialist technology recruitment as one integrated capability for organisations in the UK, EU and beyond.